2427072fd2e6592424d63414e56a98be0861817041b882ffc593011e3b5527c7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe
Size

61KB
MD5

6468ad7c8bd3fa077a4cac4f6759be1a
SHA1

d14d8adabc6018c831562ae8bf8022384039e535
SHA256

2427072fd2e6592424d63414e56a98be0861817041b882ffc593011e3b5527c7
SHA512

85a37aab0b9a1c1954509b006bbbf441870450838ddaea025f35e8cf2a32818fad7b02194c9a437cda57246854db4545a5fc2e5622d6d3aedde2022286a23611
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMXbJ:TCjsIOtEvwDpj5HE/OUHnSMu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000012253-11.dat	CryptoLocker_rule2
behavioral1/memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2520-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2520-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000012253-11.dat	CryptoLocker_set1
behavioral1/memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2520-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2520-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2520	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2520	2040	2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe	28
PID 2040 wrote to memory of 2520	2040	2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe	28
PID 2040 wrote to memory of 2520	2040	2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe	28
PID 2040 wrote to memory of 2520	2040	2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_6468ad7c8bd3fa077a4cac4f6759be1a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
f9c6d799f5e9a08a3f6860293cbc5a8a

SHA1
4bef709cd9a4245836c1b2cdb19a0dcfa931bc77

SHA256
17e6bc70467679a2feb7e78a9004cabd6c48967a5801ee4d48aa0cfe0ec7c6f5

SHA512
756e1ef88d791c629b17e49cf2e849c3a9dcc889bb4a6bf427ffe19dd5627861b4063b966121c74f6f26550433533db5e7a0bd25bd38ac33ad29104749aafbf2

Download Submit
memory/2040-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2040-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2040-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2040-4-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2040-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2520-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2520-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2520-25-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2520-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download